CVE-2026-42033

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-42033 is a prototype pollution vulnerability in Axios, a promise-based HTTP client used in browsers and Node.js environments. In versions prior to 1.15.1 and 0.31.1, Axios lacks a hasOwnProperty guard when reading keys from Object.prototype, allowing pollution by co-dependencies to compromise its internal state. This leads to two primary impacts: silent interception and modification of JSON responses before they reach the application, or full hijacking of the underlying HTTP transport layer.

Exploitation requires an attacker to first achieve prototype pollution on Object.prototype from a separate source within the same process, such as a vulnerable co-dependency. A remote attacker with no privileges can then leverage this precondition over the network, though it demands high attack complexity. Successful exploitation grants high confidentiality and integrity impacts, enabling the attacker to alter all JSON responses or access sensitive request details including credentials, headers, and body content.

The official GitHub security advisory (GHSA-pf86-5x62-jrwf) confirms the issue and states that it is fully remediated in Axios versions 1.15.1 and 0.31.1, recommending immediate upgrades to these or later versions as the primary mitigation. Affected users should audit dependencies for prototype pollution risks and review co-libraries for similar issues.